Table of Contents
Account Lockout
Repeated failed sign-in attempts temporarily lock the account. This stops somebody working through a list of passwords or verification codes until one happens to fit.
Every lock clears on its own. TetherX never locks an account permanently and never requires an administrator to unlock it: an operator who cannot sign in cannot see their cameras, which is a safety problem, not just an inconvenience.
When an Account Locks
| Trigger | Attempts allowed | Measured over |
|---|---|---|
| Wrong password | 10 | A rolling 15 minutes |
| Wrong verification code (2FA) | 5 | A rolling 15 minutes |
Fewer verification code attempts are allowed because by that point the password has already been accepted, so the code is the only thing left protecting the account.
A successful sign-in resets both counts to zero. Failures older than 15 minutes do not count towards the next lock, so an occasional typo will never build up into a lockout.
Starting again from the sign-in page does not reset either count. Somebody who knows the password cannot get unlimited guesses at your verification code by re-entering the password between tries.
How Long the Lock Lasts
| Situation | Lock duration |
|---|---|
| First lock | 15 minutes |
| Locked again with no successful sign-in in between | 1 hour |
The message on the sign-in page tells you how long is left. Once the time has passed you can sign in normally, with no further action needed.
Tip: The same message appears whether or not an account exists for the address you typed. That is deliberate, otherwise the sign-in page could be used to work out which email addresses have TetherX accounts.
Getting Back In
Wait for the lock to clear. This is the normal route. Nothing is lost, and your password has not changed.
Reset your password. Setting a new password from the emailed link clears the lock straight away, because following that link proves you control the mailbox. See Reset Your Password. This is the fastest route if you are locked out because you genuinely cannot remember your password.
Warning: Do not keep guessing while the account is locked. Every further wrong attempt after the lock expires counts towards a second lock, which lasts four times as long.
The Lockout Email
When an account locks, TetherX emails the account holder. The email states what caused the lock (wrong passwords or wrong verification codes) and when the lock clears.
This email is sent even if the user has turned other notifications off. Somebody trying to get into an account is not something a user can opt out of hearing about.
If you did not cause the lock, somebody else is trying to sign in as you. Change your password, and turn on Two-Factor Authentication if it is not already enabled. Check your recent activity for sign-ins you do not recognise.
What the Lock Does Not Do
- It does not change or reveal your password. A locked account still has the same password.
- It does not delete or disable the account. A disabled account is a separate thing, set by an administrator, and it does not expire. See User Permissions.
- It does not lock other users. Locks apply to a single account, not to a site, a Timeline or an IP address.
- It does not block password resets. You can always request a reset email, locked or not.
For Administrators
There is no unlock button, because there is nothing to unlock manually: every lock expires on its own within an hour at most.
To let a user back in immediately, send them a password reset from Admin → Users → select the user, or ask them to use Forgot your password? on the sign-in page. Setting a new password clears the lock.
Locks are recorded in the application log with the user ID, the reason and the expiry time. Related protections, including the per-IP request limits that sit underneath this, are documented in Request Throttling.
Related
- Two-Factor Authentication - Password rules, and adding a second factor to your sign-in.
- Reset Your Password - Set a new password, which also clears a lock.
- Request Throttling - The per-IP and API rate limits that sit underneath account lockout.
- Audit Log - Review recent sign-ins and activity on your account.
Referenced in: